Just received:

 

A Bill to replace New Zealand’s Privacy Act passed its third reading in Parliament today, Justice Minister Andrew Little has announced.

 

“The protections in the Privacy Bill are vitally important. The key purpose of the reforms is to promote and protect people’s privacy and give them confidence that their personal information is properly safeguarded,” said Andrew Little.

 

The Bill introduces new mechanisms to promote early intervention and risk management by agencies rather than relying on people making complaints after a privacy breach has already happened. The Bill’s reforms will also enhance the role of the Privacy Commissioner and strengthen protections for information disclosed overseas.

 

Key changes include:

 

• mandatory reporting of privacy breaches
• enabling the Privacy Commissioner to issue compliance notices
• strengthening cross-border data flow protections
• allowing the Privacy Commissioner to make binding decisions on access requests
• permitting class actions in the Human Rights Review Tribunal by persons other than the Director of Human Rights Proceedings, and
• new criminal offences.

 “Further reforms, such as a right to be forgotten or much higher penalties, require careful consideration, policy development and consultation. Given the rate of technological change and continued evolution of privacy standards, I anticipate a need for ongoing review of our privacy law to ensure it can continue to address the challenges of the digital age.”

 

The Bill will come into force on 1 December 2020.

 

I've linked to the Part 6 where the mandatory report of privacy breaches is clarified.